Allow distinct CIDR ranges access to Concourse vs Credhub

[archgrove]

We treat our Credhub and Concourse as distinct security zones. The Concourse interface has generally wider access than we'd like our Credhub instance to have.

We've been accommodating this by altering the ATC security group after running concourse-up, restricting access on 8844/8443 to a tighter set of ranges. Of course, when we rerun concourse-up deploy, this gets reset (as the group is managed by the Terraform module).

It would be super if we could specify distinct ranges for Concourse vs Credhub in concourse-up to avoid this.

[archgrove]

FYI, this might be something we can do a PR for, if it's of interest.

[crsimmons]

Personally I think this is a good idea. I'd welcome a PR.